From 17a7b4113290435560275e408b1764f4b308295f Mon Sep 17 00:00:00 2001
From: Helmut Januschka <helmut@januschka.com>
Date: Wed, 19 Sep 2018 10:06:03 +0200
Subject: add related merge request endpoint

---
 lib/api/issues.rb | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

(limited to 'lib/api')

diff --git a/lib/api/issues.rb b/lib/api/issues.rb
index e37083165f5..7909f9c7a00 100644
--- a/lib/api/issues.rb
+++ b/lib/api/issues.rb
@@ -294,6 +294,30 @@ module API
       end
       # rubocop: enable CodeReuse/ActiveRecord
 
+      desc 'List merge requests that are related to the issue'  do
+        success Entities::MergeRequestBasic
+      end
+      params do
+        requires :issue_iid, type: Integer, desc: 'The internal ID of a project issue'
+      end
+      get ':id/issues/:issue_iid/related_merge_requests' do
+        issue = find_project_issue(params[:issue_iid])
+
+        merge_request_iids = ::Issues::ReferencedMergeRequestsService.new(user_project, current_user)
+          .execute(issue)
+          .flatten
+          .map(&:iid)
+
+        merge_requests =
+          if merge_request_iids.present?
+            MergeRequestsFinder.new(current_user, project_id: user_project.id, iids: merge_request_iids).execute
+          else
+            MergeRequest.none
+          end
+
+        present paginate(merge_requests), with: Entities::MergeRequestBasic, current_user: current_user, project: user_project
+      end
+
       desc 'List merge requests closing issue'  do
         success Entities::MergeRequestBasic
       end
-- 
cgit v1.2.1


From 8d900ade3832b3e2812f067ace19bad7fd286d54 Mon Sep 17 00:00:00 2001
From: Imre Farkas <ifarkas@gitlab.com>
Date: Fri, 26 Oct 2018 16:47:03 +0200
Subject: Remove PersonalAccessTokensFinder#find_by method

find_by_token is overriden by TokenAuthenticatable which can be easily
missed or confused with #find_by(:token) defined by ActiveRecord. First
step for safer usage is to remove #find_by.
---
 lib/api/users.rb | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

(limited to 'lib/api')

diff --git a/lib/api/users.rb b/lib/api/users.rb
index 47382b09207..2a56506f3a5 100644
--- a/lib/api/users.rb
+++ b/lib/api/users.rb
@@ -512,11 +512,9 @@ module API
               PersonalAccessTokensFinder.new({ user: user, impersonation: true }.merge(options))
             end
 
-            # rubocop: disable CodeReuse/ActiveRecord
             def find_impersonation_token
-              finder.find_by(id: declared_params[:impersonation_token_id]) || not_found!('Impersonation Token')
+              finder.find_by_id(declared_params[:impersonation_token_id]) || not_found!('Impersonation Token')
             end
-            # rubocop: enable CodeReuse/ActiveRecord
           end
 
           before { authenticated_as_admin! }
-- 
cgit v1.2.1